# DF-2719 VERDICT

**Status: not_reproduced (race confirmed entered; no crash manifestation) —
impact: none observed (assessed panic/DoS if it lands) — confidence: likely.**

## Narrative

The code path is certain:

- `sigexit` → `proc_stop(SCORE)`/`proc_stopwait` (sys/kern/kern_sig.c:2394-2398)
  returns while a sibling LWP **mid-syscall** is still running:
  kern_sig.c:1598-1612 pre-counts LSSLEEP lwps as stopped; kern_sig.c:1614-1620
  only queues an AST for LSRUN lwps — both finish their current syscall
  before stopping at userret.
- If that syscall is a long `munmap`, it unlinks+frees vm_map_entry objects
  (under the vm_map lock, which the reader never takes) for its whole
  duration.
- Concurrently `generic_elf_coredump` runs `each_segment`
  (sys/kern/imgact_elf.c:1199 RB_FOREACH, no lock) four times.

Stress evidence (see README.md, race logs): core files demonstrably written
from a partially-demolished map (~8.5k of 20k entries at dump time), proving
the dump traversals and the munmap overlapped in wall-clock time across
thousands of children.

What did NOT happen in ~13,400 attempts on the INVARIANTS guest: no panic,
no wedged guest, no malformed core observed. Freed vm_map_entry objects
remain readable until objcache reuse, and an RB walk over stale-but-intact
fragments does not fault. A crash needs a torn read (entry reused or rb
links mid-rotation exactly under the reader), which these attempts did not
land.

## Why not false_positive

The overlap itself is proven by the mid-teardown core files; the unlocked
traversal is proven by reading imgact_elf.c:1199 against vm_map's locking
rules (every other RB_FOREACH over a vm_map in sys/vm/vm_map.c is performed
under vm_map_lock). The defect is real; only the catastrophic manifestation
is probabilistic and did not land within the attempt budget.

## Exploit chain

none demonstrated (read-side UAF of a dedicated-objcache object; realistic
ceiling is a kernel panic / local DoS, with a speculative cross-process
fhandle leak into the core file if a freed entry is reused by another
process's map during traversal).

## Fix

vm_map_lock/vm_map_unlock around each each_segment pass (fix.diff).
Validating the fix build is not meaningful while the baseline crash never
reproduced; fix_status = not_testable for that reason.